The name the app asked for
You see the domain each app looked up, such as api.openai.com, not a server name like a CDN edge. CNAME chains are followed back to the original question.
See the domains your apps look up
Turn bare IP addresses into the names your apps actually asked for, like www.youtube.com, without sending anything off your Mac.
| Process | Remote | Domain |
|---|---|---|
| locationd | 17.253.144.10:443 | gs-loc.apple.com |
| Google Chrome Helper | 142.250.185.78:443 | www.youtube.com |
| Safari | 151.101.1.140:443 | www.reddit.com |
| Slack | [2a03:2880:f12f:83::25de]:443 | graph.facebook.com |
| ChatGPT | 104.18.32.47:443 | api.openai.com |
| Dropbox | 52.94.236.248:443 | ec2-52-94-236-248.compute-1.amazonaws.com |
Illustration: connection rows with the observed domain in black, a reverse-DNS name in grey italics.
Approve once, no Terminal
Click Enable domain names and approve the helper once in System Settings › General › Login Items. No commands to type.
Runs only when needed
macOS starts the helper when LightAtom connects to it, and it quits after 10 idle minutes. Remove it with one button.
Reads DNS answers only
The helper captures DNS responses on port 53 and keeps recent “IP → name” pairs in memory. It never reads other traffic.
Locked to LightAtom
The app and the helper check each other’s code signatures, so no other program can talk to the helper.
Reverse DNS, if you want it
An optional toggle asks your DNS resolver for each server’s own name (PTR record), shown in grey. It’s off by default because it sends the IPs to your resolver.
How it works
Seeing DNS answers requires access to the Mac’s packet-capture device, which only root has. So instead of running the whole app as root, LightAtom installs a tiny privileged helper with Apple’s Service Management framework. The helper captures only DNS responses (udp src port 53) and hands the app new “IP → name” pairs every two seconds.
Limits: it only sees lookups made after it starts, and it can’t see encrypted DNS: DNS over HTTPS or TLS, iCloud Private Relay, or Chrome’s secure DNS. Connections made that way keep their IP until reverse DNS (if enabled) names the server.
Questions
Why does LightAtom need a helper for domain names?
Reading DNS answers needs access to packet capture, which macOS reserves for root. A small helper with only that job keeps the main app unprivileged.
Does the helper read my web traffic?
No. Its capture filter only lets DNS responses through, and it only reads the question and the IPv4/IPv6 answers. Everything stays in memory on your Mac.
Why do some connections still show only an IP?
The app either looked the name up before LightAtom started, or it used encrypted DNS (DoH, DoT, iCloud Private Relay or Chrome’s secure DNS), which the helper can’t read.
How do I remove the helper?
Open the Domain names settings sheet in LightAtom and click Remove Helper. It’s also listed under System Settings › General › Login Items.